ci: PR時にJekyll buildをチェックするワークフローを追加 (#1345)

* ci: add Jekyll build check for PRs and fix zizmor warnings

- Add new jekyll-build.yml workflow to check Jekyll build on pull requests
- Update deploy.yml and jekyll-build.yml to reference .ruby-version file
- Pin mastofeedbot action to commit hash
- Add persist-credentials: false to checkout actions
- Add permissions to rss-to-mastodon.yml and rss-to-twitter.yml jobs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* ci: keep credentials for deploy workflow

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* ci: enable bundler cache for ruby setup

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: azu

.github/workflows/deploy.yml

@@ -9,11 +9,11 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 # zizmor: ignore[artipacked]
         with:
           lfs: 'true'
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 18
       - name: Install
@@ -23,15 +23,14 @@ jobs:
       - name: Build
         run: npm run build
       - name: Install Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@708024e6c902387ab41de36e1669e43b5ee7085e # v1.283.0
         with:
-          ruby-version: 2.7.8
-      - name: Bundle install
-        run: bundle install
+          ruby-version-file: '.ruby-version'
+          bundler-cache: true
       - name: Build Jekyll
         run: bundle exec jekyll build
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         if: github.ref == 'refs/heads/develop'
         with:
           github_token: ${{ secrets.SHARED_BOT_GITHUB_TOKEN }}

.github/workflows/jekyll-build.yml

@@ -0,0 +1,31 @@
+name: Jekyll Build
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          lfs: 'true'
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 18
+      - name: Install npm dependencies
+        run: yarn install
+      - name: Build
+        run: npm run build
+      - name: Install Ruby
+        uses: ruby/setup-ruby@708024e6c902387ab41de36e1669e43b5ee7085e # v1.283.0
+        with:
+          ruby-version-file: '.ruby-version'
+          bundler-cache: true
+      - name: Build Jekyll
+        run: bundle exec jekyll build

.github/workflows/rss-to-mastodon.yml

@@ -7,23 +7,25 @@ on:
 jobs:
   realtime:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Generate cache key
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         id: generate-key
         with:
           script: |
             core.setOutput('cache-key', new Date().valueOf())
 
       - name: Retrieve cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ${{ github.workspace }}/mastofeedbot
           key: feed-cache-realtime-jser-info-${{ steps.generate-key.outputs.cache-key }}
           restore-keys: feed-cache-realtime-jser-info-
 
       - name: JSer.info
-        uses: 'jser/mastofeedbot@main'
+        uses: 'jser/mastofeedbot@0e1dbc3e480b4a35d5a01dd539f2341f5b785afd' # main
         with:
           rss-feed: https://realtime.jser.info/feed.xml
           api-endpoint: https://mstdn.jp
@@ -33,23 +35,25 @@ jobs:
 
   jser:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Generate cache key
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         id: generate-key
         with:
           script: |
             core.setOutput('cache-key', new Date().valueOf())
 
       - name: Retrieve cache
-        uses: actions/cache@v3
+        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ${{ github.workspace }}/mastofeedbot
           key: feed-cache-jser-info-${{ steps.generate-key.outputs.cache-key }}
           restore-keys: feed-cache-jser-info-
 
       - name: JSer.info
-        uses: 'jser/mastofeedbot@main'
+        uses: 'jser/mastofeedbot@0e1dbc3e480b4a35d5a01dd539f2341f5b785afd' # main
         with:
           rss-feed: https://jser.info/rss/
           api-endpoint: https://mstdn.jp

.github/workflows/rss-to-twitter.yml

@@ -4,11 +4,12 @@ on:
 jobs:
   twitter:
     runs-on: ubuntu-latest
+    permissions: {}
     # if github.event.build.error.message is not null, it means that the build failed. Skip it
     if: ${{ github.event.build.error.message == null }}
     steps:
       # https://github.com/azu/rss-to-twitter
-      - uses: azu/rss-to-twitter@v1
+      - uses: azu/rss-to-twitter@f20e6ba3ed2dc03d86578775a5d2a3afb5bff966 # v1.1.0
         with:
           RSS_URL: "https://jser.info/rss/"
           TWEET_TEMPLATE: '更新しました！ "%title%" %url%'

.github/workflows/textlint.yml

@@ -11,15 +11,17 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      with:
+        persist-credentials: false
     - name: Setup Node.js
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
       with:
         node-version: 18
     - name: Install
       run: yarn install
     - name: textlint reviewdog
-      uses: tsuyoshicho/action-textlint@v3
+      uses: tsuyoshicho/action-textlint@689c87690ef3b954b5039bcb15589863c9e021a1 # v3.11.1
       with:
         github_token: ${{ secrets.github_token }}
         reporter: github-pr-review

.github/workflows/update-draft-pr.yml

@@ -14,9 +14,11 @@ jobs:
     if: github.event_name == 'pull_request' && (github.event.pull_request.author_association == 'MEMBER' || github.event.pull_request.author_association == 'OWNER' || github.event.pull_request.author_association == 'COLLABORATOR')
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 18
       - name: Install